feat(cli): build an installable npm tarball - #3173
Conversation
📝 WalkthroughProblem solvedThis PR creates a publishable The build uses an isolated source archive, exact Source of truth and solution sizeThe PR extends the existing workspace and committed source. It does not create a parallel source path. The generated manifest and tarball are release outputs. The solution is coherent but substantial because it must package a private workspace safely. The release script validates inputs, stages runtime files, removes development artifacts, checks dependency patches and notices, rejects unsafe files, and verifies the final tarball. The smoke test validates offline installation and installed behavior. Simplification opportunitiesNo clear deletion is supported by the current summary. The file-policy tests, Eval path tests, packaging checks, notice validation, and smoke tests cover separate release risks. Any simplification should preserve coverage for dependency closure, native assets, package contents, licensing, offline installation, and CLI behavior. Validation and risksReported validation includes:
Cross-platform CI, real Harbor/Pier cells, and protected OIDC publishing remain follow-up work. Final required-check status is unverified from the available evidence. Review-relevant risks
The person performing the merge reviews the final diff. A maintainer makes the final determination. WalkthroughThe CLI release flow now configures installed Eval assets, generates target-specific notices, builds sanitized release archives, and validates them through offline installation smoke tests. ChangesCLI runtime setup
Release preparation and packaging
Release validation
Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: 🔵 Low · up to The PR adds an installable CLI tarball and packaged Eval resources. The artifact is supported by extensive checks, but the release smoke validation can intermittently fail on PTY output timing or stall during offline installation, so merge is reasonable with explicit owner awareness and follow-up. Sequence Diagram(s)sequenceDiagram
participant ReleaseCommand as npm release command
participant PackageScript as release-cli-package.mjs
participant BuildWorkspace as isolated clean build
participant Tarball as CLI tarball
participant SmokeTest as smoke-release-cli-package.mjs
ReleaseCommand->>PackageScript: start CLI release
PackageScript->>BuildWorkspace: build and audit dependencies
BuildWorkspace->>PackageScript: return build artifacts
PackageScript->>Tarball: stage, validate, and pack files
SmokeTest->>Tarball: install package offline
SmokeTest->>SmokeTest: validate CLI, native modules, and runtime files
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
PR Summary by QodoBuild reproducible installable npm tarball for Maka CLI
AI Description
Diagram
High-Level Assessment
Files changed (13)
|
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
scripts/generate-third-party-notices.mjs (1)
31-32: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winGuard the target lookup against inherited
Object.prototypekeys.
TARGETS[targetName]resolves inherited members.--target constructoror--target toStringreturns a truthy value, so the guard on Line 32 does not fire. The script then callsnpm ls --workspace undefinedand fails with an unrelated message. Use an own-property check.♻️ Proposed change
-const target = TARGETS[targetName]; -if (!target) throw new Error(`Unsupported notice target: ${targetName}`); +if (!Object.hasOwn(TARGETS, targetName)) { + throw new Error(`Unsupported notice target: ${targetName}`); +} +const target = TARGETS[targetName];scripts/release-cli-package.mjs (1)
273-278: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueExtract the pinned
undiciversion into one constant.The exact version
8.10.0appears at Line 273 and Line 456. An upgrade must change both places. A single constant removes that coupling.♻️ Proposed change
+const EVAL_UNDICI_VERSION = '8.10.0';- const evalUndici = findDependency(cli, 'undici', '8.10.0'); + const evalUndici = findDependency(cli, 'undici', EVAL_UNDICI_VERSION); if (!evalUndici?.path || !existsSync(evalUndici.path)) { - throw new Error('The installed CLI closure does not contain undici@8.10.0'); + throw new Error(`The installed CLI closure does not contain undici@${EVAL_UNDICI_VERSION}`); }- const undici = findDependency(cli, 'undici', '8.10.0'); + const undici = findDependency(cli, 'undici', EVAL_UNDICI_VERSION);Also applies to: 456-457
scripts/smoke-release-cli-package.mjs (1)
24-39: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd a timeout to the offline install.
runapplies a 30 s timeout, but thisexecFileSynccall has none. Ifnpm install --offlinehangs, the smoke test blocks the pipeline with no diagnostic. A bounded timeout produces a clear failure.♻️ Proposed change
- npmSpawnOptions({ cwd: root, stdio: 'inherit' }), + npmSpawnOptions({ cwd: root, stdio: 'inherit', timeout: 300_000 }),
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 715f1b0b-3733-4875-9c9e-e9d8266d6438
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (13)
.gitignorepackage.jsonpackages/cli/README.mdpackages/cli/THIRD_PARTY_NOTICES.txtpackages/cli/package.jsonpackages/cli/src/__tests__/eval-bundle-path.test.tspackages/cli/src/cli-core.tspackages/cli/src/eval-bundle-path.tsscripts/generate-third-party-notices.mjsscripts/release-cli-file-policy.mjsscripts/release-cli-file-policy.test.mjsscripts/release-cli-package.mjsscripts/smoke-release-cli-package.mjs
Included review availability: Your plan includes up to 3 reviews per rolling hour; 2 remain after this review.
Code Review by Qodo
1.
|
Assemble the installed production closure into one public package while preserving private workspace topology, Eval runtime assets, native prebuilds, and reviewed dependency patches. Validate the final artifact and prove an offline global install without registry resolution or install-time builds. Generated-by: OpenAI Codex
Build publishable CLI artifacts from an isolated archive after an exact npm ci so ignored local dependency changes cannot enter the release. Apply one audited development-file policy to third-party packages during staging and final validation while preserving runtime JavaScript and native assets. Generated-by: OpenAI Codex
c34d22c to
ded2081
Compare
|
I have reviewed the final revision and accept responsibility for its accuracy, provenance, licensing, and the disclosed AI-assisted content. |
English
Summary
Refs #3166
Builds
maka-agent@0.1.0-beta.1as one installable npm tarball containing the exact production dependency closure, private@maka/*runtime packages, Eval resources, native prebuilds, dependency patches, and license notices. The source workspace remains private; only the generated manifest is publishable.Publishable artifacts are built from the committed source in an isolated tree after an exact
npm ci, so ignored local dependency changes cannot enter the release. A single audited file policy removes third-party tests, fixtures, coverage, TypeScript sources, declarations, and source maps while preserving runtime JavaScript and native assets.The installed CLI points Eval container mounts at its packaged resource mirror without overriding an explicit user path. Install-time dependency scripts and native compilation are removed from the release snapshot.
Verification
npm run release:cli:pack— 14.3 MiB tarball, stable SHA-256d288fe0e6018f8f420ea865446bf36c7848eda917c80867dc8301c6f71c3d551across two isolated buildsnpm run release:cli:smoke— offline empty-cache install; both bins, Eval import, PTY, native file locks, workers, assets, and patches verifiednpm --workspace maka-agent run test:dist— 265 passednpm run rebuildnpm run typechecknpm run check:releasenpm run format:checknpm run lintFollow-up
The cross-platform CI matrix, real Harbor/Pier cells, and protected OIDC publishing workflow remain separate follow-up PRs.
中文
概要
关联 #3166
将
maka-agent@0.1.0-beta.1组装为单一可安装 npm tarball，包含精确生产依赖闭包、私有@maka/*运行包、Eval 资源、原生 prebuild、依赖补丁和许可证声明。源码 workspace 继续保持 private，只有生成的最终 manifest 可发布。可发布产物会从当前提交导出隔离源码树，并在精确执行
npm ci后构建，因此本机被忽略的依赖修改无法进入发布包。统一且可审查的文件策略会排除第三方测试、fixture、coverage、TypeScript 源文件、类型声明和 source map，同时保留运行时 JavaScript 与原生产物。安装态 CLI 会将 Eval 容器挂载指向包内资源镜像，同时保留用户显式配置。发布快照不会在用户机器上执行依赖安装脚本或编译原生模块。
验证
npm run release:cli:pack— 14.3 MiB，两次隔离构建均得到 SHA-256d288fe0e6018f8f420ea865446bf36c7848eda917c80867dc8301c6f71c3d551npm run release:cli:smoke— 空 cache 离线安装；验证两个命令、Eval 导入、PTY、原生文件锁、worker、资源和补丁npm --workspace maka-agent run test:dist— 265 项通过npm run rebuildnpm run typechecknpm run check:releasenpm run format:checknpm run lint后续
跨平台 CI 矩阵、真实 Harbor/Pier cell 和受保护的 OIDC 发布 workflow 将在后续 PR 中完成。
AI use
Tool(s) and scope: OpenAI Codex — implementation, tests, packaging analysis, and verification.
Checklist
Does this PR entail a change in behavior?